Skip to content

ADR-0005: Use Just-In-Time (JIT) User Provisioning

  • Status: Accepted
  • Date: 2025-09-11
  • Authors: Senior Systems Analyst

Context and Problem Statement

Following the decision to use Google SSO (ADR-0001), we need a strategy for creating user accounts within our application's database. A manual process where administrators must create an account for every new user is inefficient, slow, and prone to error. We need a more streamlined and automated approach.

Considered Options

  • Option 1: Manual or Pre-provisioning Only

    • Description: Administrators must use an "Invite User" feature to create a placeholder account for every user before they can log in for the first time.
    • Pros:
      • Gives administrators full control over who is allowed into the system.
      • Allows for pre-assignment of specific permissions.
    • Cons:
      • Creates a significant administrative bottleneck.
      • Poor user experience for new employees who cannot access the system until an admin has acted.
      • Does not scale well with a growing organization.

  • Option 2: Just-In-Time (JIT) Provisioning with an Invitation Override (Chosen)

    • Description: By default, any user who successfully authenticates with a valid corporate Google account will have an account automatically created in our database upon their very first login. This is supplemented by an "Invite User" feature that allows admins to pre-provision an account to assign non-default permissions.
    • Pros:
      • Zero-Touch for Most Users: The majority of users can access the system immediately without any administrative action.
      • Reduced Administrative Overhead: Drastically cuts down on routine account creation tasks.
      • Flexibility: The optional invitation flow still allows for pre-configuration of permissions for users with special access needs.
    • Cons:
      • Less Control over Initial Access: Any user with a corporate account can, by default, get a basic user record in the system.

Decision

We will implement a Just-In-Time (JIT) Provisioning model as the default, supplemented by an administrative "Invite User" feature. The primary path for user creation will be automatic.

Consequences

Positive

  • The onboarding process for new users is seamless and immediate.
  • The workload for system administrators is significantly reduced.
  • The system combines the efficiency of automation with the control of manual pre-configuration when needed.

Negative

  • We must rely on the domain restriction in the SSO flow as the primary gatekeeper. This is an acceptable control, as our goal is to allow all corporate employees to have at least baseline access.